Privacy
What we hold, who can read it, where it is kept, and how to take a copy or delete all of it. Last updated 13 October 2026.
Who is asking
Margin Club publishes research on businesses and runs a small members’ club around it. We decide what is collected here, so under the GDPR we are the controller. Write to privacy@margin.club about anything on this page and a person answers, within thirty days and usually the same week.
What we hold
Your Google account
Name, email address, profile picture and the Google account id. Nothing else — the sign-in asks for openid, email and profile, and no other permission. It is how an account exists and how we reach you about it.
What you write in the club
Messages and the files you attach. Sealed before they are stored (see below) and shown only to the rooms you are in.
Your application
The three answers you send with it, and the decision. Read by the people reviewing applications.
Membership and notification settings
Which rooms you are in, and how loudly each one speaks.
Your email, if you subscribe
The address, when you sent it, which form it came from, and a salted hash of the IP address at that moment. The hash exists to stop one machine signing up ten thousand addresses, and cannot be turned back into an address.
Who is online
An id and a timestamp, rewritten while a tab is open. The database drops the row two minutes after the tab closes, by itself.
The session
One cookie, httpOnly, so no script on the page can read it. The matching row in our database is what makes it valid, which is what lets a lost laptop be signed out from here.
The club chat, honestly
Every message and every attached file is encrypted before it is written down. Each room has its own key; that key is itself encrypted with a master key held in the server’s environment and never stored next to the data. Someone who walks off with a copy of the database, or of the file bucket, gets ciphertext. Attachments never go to the storage provider directly from your browser — they pass through our server to be sealed first — and the address of a file only works for someone whose session is in that room.
This is not end-to-end encryption, and we will not call it that. The server can decrypt, because it has to render the room in your browser. So: we can read the club if we choose to, we will if a court in the EU orders us to, and we do look at reported messages when moderating. What the sealing buys you is that a stolen backup, a mislaid disk or a careless storage provider reveals nothing — not that your words are mathematically out of our reach. If you need that, use Signal.
Nothing in the club is indexed by search engines, and nothing in it is public. Rooms are visible only to the people admitted to them.
What we do not do
- No analytics. No Google Analytics, no Plausible, no Meta or TikTok pixel, no session recording, no heat maps.
- No advertising, and no selling or renting of anything on this page to anyone, ever.
- No third-party scripts on the page at all. Fonts are served from this domain, not from a font CDN, so no one learns you were here from a stylesheet.
- No tracking cookies. The only cookie is the session, and a signed-out visitor is given none.
- No reading of your mail, calendar or files. The Google sign-in cannot: it was never granted the permission.
Who else touches it
Four companies, each doing one job under a data-processing agreement, none of them allowed to use anything for their own purposes:
MongoDB Atlas
The database: accounts, messages, settings. Reachable only from our server's single IP address, never from the open internet.
Hetzner
The machine the site runs on.
Cloudflare
DNS, TLS, and the bucket that holds attachments. Files are sealed with the room's key before they are sent, so what Cloudflare holds is ciphertext and the bucket has no public address.
Sign-in only, and only when you choose to sign in.
Transfers to the United States run on the EU–US Data Privacy Framework and the standard contractual clauses. Payments, when membership opens, will go through Stripe, which will then appear on this list — we never see or store a card number.
What you can do about it
Both of the rights that matter are buttons rather than an email thread:
Deleting the account removes it, the rooms you were in, your settings, your application and its answers, your newsletter row, and every message you wrote — immediately, not in thirty days, and not into a recycle bin. Conversations will have holes in them where you spoke; that is the trade, and we would rather leave holes than keep your words under a tombstone name. What survives is one line saying an account was deleted on that day, with a salted hash in place of who. Backups roll over within thirty days.
You can also correct anything (Settings holds your name, picture and intro), object to a use you disagree with, and complain to your national data-protection authority if our answer does not satisfy you. Email does all three.
Why we are allowed to
Your account, the club and its messages are there to deliver what you signed up for, so the basis is the contract between us. The newsletter and the application are consent, which you withdraw by unsubscribing or by deleting the account. The rate limits, the IP hash and the moderation log are our legitimate interest in not being flooded or abused. Nothing here is profiling, and nothing is an automated decision about you — applications are read by people.
If something goes wrong
If data leaks in a way that could hurt the people in it, we tell the supervisory authority within seventy-two hours and the members affected as soon as we know who they are, in plain words: what went, when, and what we did. We will not describe a breach as an “incident affecting certain information”.
Small print that is actually small
You need to be sixteen to have an account. If this page changes in a way that matters, members are emailed before it takes effect — a new date at the top is not notice. Earlier versions are in the site’s git history, which is the only changelog worth trusting.